oslist = ['NT-SP3', 'NT-SP4', 'NT-SP5', 'NT-SP6', '2K-SP0', '2K-SP1', '2K-SP2', '2K-SP3', '2K-SP4', 'XP-SP0', 'XP-SP1', 'XP-SP2', 'XP-SP3', '2003-SP0', '2003-SP1', 'VISTA-SP0', 'SEVEN-SP0']
syscalls = {
    'NtAcceptConnectPort': [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
    'NtAccessCheck': [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1],
    'NtAccessCheckAndAuditAlarm': [2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2],
    'NtAccessCheckByType': [-1, -1, -1, -1, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3],
    'NtAccessCheckByTypeAndAuditAlarm': [-1, -1, -1, -1, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4, 4],
    'NtAccessCheckByTypeResultList': [-1, -1, -1, -1, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5],
    'NtAccessCheckByTypeResultListAndAuditAlarm': [-1, -1, -1, -1, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6],
    'NtAccessCheckByTypeResultListAndAuditAlarmByHandle': [-1, -1, -1, -1, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7],
    'NtAddAtom': [3, 3, 3, 3, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8, 8],
    'NtAddBootEntry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 9, 9, 9, -1, 9, 9, 9, 9],
    'NtAddDriverEntry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 10, 10, 10, 10],
    'NtAdjustGroupsToken': [4, 4, 4, 4, 9, 9, 9, 9, 9, 10, 10, 10, 10, 11, 11, 11, 11],
    'NtAdjustPrivilegesToken': [5, 5, 5, 5, 10, 10, 10, 10, 10, 11, 11, 11, 11, 12, 12, 12, 12],
    'NtAlertResumeThread': [6, 6, 6, 6, 11, 11, 11, 11, 11, 12, 12, 12, 12, 13, 13, 13, 13],
    'NtAlertThread': [7, 7, 7, 7, 12, 12, 12, 12, 12, 13, 13, 13, 13, 14, 14, 14, 14],
    'NtAllocateLocallyUniqueId': [8, 8, 8, 8, 13, 13, 13, 13, 13, 14, 14, 14, 14, 15, 15, 15, 15],
    'NtAllocateReserveObject': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 16],
    'NtAllocateUserPhysicalPages': [-1, -1, -1, -1, 14, 14, 14, 14, 14, 15, 15, 15, 15, 16, 16, 16, 17],
    'NtAllocateUuids': [9, 9, 9, 9, 15, 15, 15, 15, 15, 16, 16, 16, 16, 17, 17, 17, 18],
    'NtAllocateVirtualMemory': [10, 10, 10, 10, 16, 16, 16, 16, 16, 17, 17, 17, 17, 18, 18, 18, 19],
    'NtAlpcAcceptConnectPort': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 19, 20],
    'NtAlpcCancelMessage': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 20, 21],
    'NtAlpcConnectPort': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 21, 22],
    'NtAlpcCreatePort': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 22, 23],
    'NtAlpcCreatePortSection': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 23, 24],
    'NtAlpcCreateResourceReserve': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 24, 25],
    'NtAlpcCreateSectionView': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 25, 26],
    'NtAlpcCreateSecurityContext': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 26, 27],
    'NtAlpcDeletePortSection': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 27, 28],
    'NtAlpcDeleteResourceReserve': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 28, 29],
    'NtAlpcDeleteSectionView': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 29, 30],
    'NtAlpcDeleteSecurityContext': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 30, 31],
    'NtAlpcDisconnectPort': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 31, 32],
    'NtAlpcImpersonateClientOfPort': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 32, 33],
    'NtAlpcOpenSenderProcess': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 33, 34],
    'NtAlpcOpenSenderThread': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 34, 35],
    'NtAlpcQueryInformation': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 35, 36],
    'NtAlpcQueryInformationMessage': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 36, 37],
    'NtAlpcRevokeSecurityContext': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 38],
    'NtAlpcSendWaitReceivePort': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 37, 39],
    'NtAlpcSetInformation': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 38, 40],
    'NtApphelpCacheControl': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 19, 19, 39, 41],
    'NtAreMappedFilesTheSame': [-1, -1, -1, -1, 17, 17, 17, 17, 17, 18, 18, 18, 18, 20, 20, 40, 42],
    'NtAssignProcessToJobObject': [-1, -1, -1, -1, 18, 18, 18, 18, 18, 19, 19, 19, 19, 21, 21, 41, 43],
    'NtCallbackReturn': [11, 11, 11, 11, 19, 19, 19, 19, 19, 20, 20, 20, 20, 22, 22, 42, 44],
    'NtCancelDeviceWakeupRequest': [-1, -1, -1, -1, 22, 22, 22, 22, 22, 21, 21, 21, -1, 23, 23, 43, -1],
    'NtCancelIoFile': [12, 12, 12, 12, 20, 20, 20, 20, 20, 22, 22, 22, 22, 24, 24, 44, 45],
    'NtCancelIoFileEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 370, 46],
    'NtCancelSynchronousIoFile': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 371, 47],
    'NtCancelTimer': [13, 13, 13, 13, 21, 21, 21, 21, 21, 23, 23, 23, 23, 25, 25, 45, 48],
    'NtClearAllSavepointsTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 283, -1],
    'NtClearEvent': [14, 14, 14, 14, 23, 23, 23, 23, 23, 24, 24, 24, 24, 26, 26, 46, 49],
    'NtClearMUILicenseInfo': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 391, -1],
    'NtClearSavepointTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 282, -1],
    'NtClose': [15, 15, 15, 15, 24, 24, 24, 24, 24, 25, 25, 25, 25, 27, 27, 47, 50],
    'NtCloseObjectAuditAlarm': [16, 16, 16, 16, 25, 25, 25, 25, 25, 26, 26, 26, 26, 28, 28, 48, 51],
    'NtCommitComplete': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 93, 52],
    'NtCommitEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 85, 53],
    'NtCommitTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 89, 54],
    'NtCompactKeys': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 27, 27, 27, 27, 29, 29, 49, 55],
    'NtCompareTokens': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 28, 28, 28, 28, 30, 30, 50, 56],
    'NtCompleteConnectPort': [17, 17, 17, 17, 26, 26, 26, 26, 26, 29, 29, 29, 29, 31, 31, 51, 57],
    'NtCompressKey': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 30, 30, 30, 30, 32, 32, 52, 58],
    'NtConnectPort': [18, 18, 18, 18, 27, 27, 27, 27, 27, 31, 31, 31, 31, 33, 33, 53, 59],
    'NtContinue': [19, 19, 19, 19, 28, 28, 28, 28, 28, 32, 32, 32, 32, 34, 34, 54, 60],
    'NtCreateChannel': [205, 204, 204, 204, 241, 241, 241, 241, 241, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtCreateDebugObject': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 33, 33, 33, 33, 35, 35, 55, 61],
    'NtCreateDirectoryObject': [20, 20, 20, 20, 29, 29, 29, 29, 29, 34, 34, 34, 34, 36, 36, 56, 62],
    'NtCreateEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 109, 63],
    'NtCreateEvent': [21, 21, 21, 21, 30, 30, 30, 30, 30, 35, 35, 35, 35, 37, 37, 57, 64],
    'NtCreateEventPair': [22, 22, 22, 22, 31, 31, 31, 31, 31, 36, 36, 36, 36, 38, 38, 58, 65],
    'NtCreateFile': [23, 23, 23, 23, 32, 32, 32, 32, 32, 37, 37, 37, 37, 39, 39, 59, 66],
    'NtCreateIoCompletion': [24, 24, 24, 24, 33, 33, 33, 33, 33, 38, 38, 38, 38, 40, 40, 60, 67],
    'NtCreateJobObject': [-1, -1, -1, -1, 34, 34, 34, 34, 34, 39, 39, 39, 39, 41, 41, 61, 68],
    'NtCreateJobSet': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 40, 40, 40, 40, 42, 42, 62, 69],
    'NtCreateKey': [25, 25, 25, 25, 35, 35, 35, 35, 35, 41, 41, 41, 41, 43, 43, 63, 70],
    'NtCreateKeyTransacted': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 72],
    'NtCreateKeyedEvent': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 279, 279, 279, 279, 289, 289, 361, 71],
    'NtCreateMailslotFile': [26, 26, 26, 26, 36, 36, 36, 36, 36, 42, 42, 42, 42, 44, 44, 64, 73],
    'NtCreateMutant': [27, 27, 27, 27, 37, 37, 37, 37, 37, 43, 43, 43, 43, 45, 45, 65, 74],
    'NtCreateNamedPipeFile': [28, 28, 28, 28, 38, 38, 38, 38, 38, 44, 44, 44, 44, 46, 46, 66, 75],
    'NtCreatePagingFile': [29, 29, 29, 29, 39, 39, 39, 39, 39, 45, 45, 45, 45, 47, 47, 68, 76],
    'NtCreatePort': [30, 28, 30, 30, 40, 40, 40, 40, 40, 46, 46, 46, 46, 48, 48, 69, 77],
    'NtCreatePrivateNamespace': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 67, 78],
    'NtCreateProcess': [31, 31, 31, 31, 41, 41, 41, 41, 41, 47, 47, 47, 47, 49, 49, 70, 79],
    'NtCreateProcessEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 48, 48, 48, 48, 50, 50, 71, 80],
    'NtCreateProfile': [32, 32, 32, 32, 42, 42, 42, 42, 42, 49, 49, 49, 49, 51, 51, 72, 81],
    'NtCreateProfileEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 82],
    'NtCreateResourceManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 105, 83],
    'NtCreateSection': [33, 33, 33, 33, 43, 43, 43, 43, 43, 50, 50, 50, 50, 52, 52, 73, 84],
    'NtCreateSemaphore': [34, 34, 34, 34, 44, 44, 44, 44, 44, 51, 51, 51, 51, 53, 53, 74, 85],
    'NtCreateSymbolicLinkObject': [35, 35, 35, 35, 45, 45, 45, 45, 45, 52, 52, 52, 52, 54, 54, 75, 86],
    'NtCreateThread': [36, 36, 36, 36, 46, 46, 46, 46, 46, 53, 53, 53, 53, 55, 55, 76, 87],
    'NtCreateThreadEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 385, 88],
    'NtCreateTimer': [37, 37, 37, 37, 47, 47, 47, 47, 47, 54, 54, 54, 54, 56, 56, 77, 89],
    'NtCreateToken': [38, 38, 38, 38, 48, 48, 48, 48, 48, 55, 55, 55, 55, 57, 57, 78, 90],
    'NtCreateTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 79, 91],
    'NtCreateTransactionManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 98, 92],
    'NtCreateUserProcess': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 93],
    'NtCreateWaitablePort': [-1, -1, -1, -1, 49, 49, 49, 49, 49, 56, 56, 56, 56, 58, 58, 114, 94],
    'NtCreateWinStation': [-1, 211, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtCreateWorkerFactory': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 378, 95],
    'NtDebugActiveProcess': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 57, 57, 57, 57, 59, 59, 115, 96],
    'NtDebugContinue': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 58, 58, 58, 58, 60, 60, 116, 97],
    'NtDelayExecution': [39, 39, 39, 39, 50, 50, 50, 50, 50, 59, 59, 59, 59, 61, 61, 117, 98],
    'NtDeleteAtom': [40, 40, 40, 40, 51, 51, 51, 51, 51, 60, 60, 60, 60, 62, 62, 118, 99],
    'NtDeleteBootEntry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 61, 61, 61, -1, 63, 63, 119, 100],
    'NtDeleteDriverEntry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 64, 64, 120, 101],
    'NtDeleteFile': [41, 41, 41, 41, 52, 52, 52, 52, 52, 62, 62, 62, 62, 65, 65, 121, 102],
    'NtDeleteKey': [42, 42, 42, 42, 53, 53, 53, 53, 53, 63, 63, 63, 63, 66, 66, 122, 103],
    'NtDeleteObjectAuditAlarm': [43, 43, 43, 43, 54, 54, 54, 54, 54, 64, 64, 64, 64, 67, 67, 124, 104],
    'NtDeletePrivateNamespace': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 123, 105],
    'NtDeleteValueKey': [44, 44, 44, 44, 55, 55, 55, 55, 55, 65, 65, 65, 65, 68, 68, 125, 106],
    'NtDeviceIoControlFile': [45, 45, 45, 45, 56, 56, 56, 56, 56, 66, 66, 66, 66, 69, 69, 126, 107],
    'NtDisableLastKnownGood': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 108],
    'NtDisplayString': [46, 46, 46, 46, 57, 57, 57, 57, 57, 67, 67, 67, 67, 70, 70, 127, 109],
    'NtDrawText': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 110],
    'NtDuplicateObject': [47, 47, 47, 47, 58, 58, 58, 58, 58, 68, 68, 68, 68, 71, 71, 128, 111],
    'NtDuplicateToken': [48, 48, 48, 48, 59, 59, 59, 59, 59, 69, 69, 69, 69, 72, 72, 129, 112],
    'NtEnableLastKnownGood': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 113],
    'NtEnumerateBootEntries': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 70, 70, 70, 9, 73, 73, 130, 114],
    'NtEnumerateDriverEntries': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 74, 74, 131, 115],
    'NtEnumerateKey': [49, 49, 49, 49, 60, 60, 60, 60, 60, 71, 71, 71, 71, 75, 75, 132, 116],
    'NtEnumerateSystemEnvironmentValuesEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 72, 72, 72, 72, 76, 76, 133, 117],
    'NtEnumerateTransactionObject': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 118],
    'NtEnumerateValueKey': [50, 50, 50, 50, 61, 61, 61, 61, 61, 73, 73, 73, 73, 77, 77, 134, 119],
    'NtExtendSection': [51, 51, 51, 51, 62, 62, 62, 62, 62, 74, 74, 74, 74, 78, 78, 135, 120],
    'NtFilterToken': [-1, -1, -1, -1, 63, 63, 63, 63, 63, 75, 75, 75, 75, 79, 79, 136, 121],
    'NtFindAtom': [52, 52, 52, 52, 64, 64, 64, 64, 64, 76, 76, 76, 76, 80, 80, 137, 122],
    'NtFlushBuffersFile': [53, 53, 53, 53, 65, 65, 65, 65, 65, 77, 77, 77, 77, 81, 81, 138, 123],
    'NtFlushInstallUILanguage': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 393, 124],
    'NtFlushInstructionCache': [54, 54, 54, 54, 66, 66, 66, 66, 66, 78, 78, 78, 78, 82, 82, 139, 125],
    'NtFlushKey': [55, 55, 55, 55, 67, 67, 67, 67, 67, 79, 79, 79, 79, 83, 83, 140, 126],
    'NtFlushProcessWriteBuffers': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 141, 127],
    'NtFlushVirtualMemory': [56, 56, 56, 56, 68, 68, 68, 68, 68, 80, 80, 80, 80, 84, 84, 142, 128],
    'NtFlushWriteBuffer': [57, 57, 57, 57, 69, 69, 69, 69, 69, 81, 81, 81, 81, 85, 85, 143, 129],
    'NtFreeUserPhysicalPages': [-1, -1, -1, -1, 70, 70, 70, 70, 70, 82, 82, 82, 82, 86, 86, 144, 130],
    'NtFreeVirtualMemory': [58, 58, 58, 58, 71, 71, 71, 71, 71, 83, 83, 83, 83, 87, 87, 145, 131],
    'NtFreezeRegistry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 146, 132],
    'NtFreezeTransactions': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 147, 133],
    'NtFsControlFile': [59, 59, 59, 59, 72, 72, 72, 72, 72, 84, 84, 84, 84, 88, 88, 148, 134],
    'NtGetContextThread': [60, 60, 60, 60, 73, 73, 73, 73, 73, 85, 85, 85, 85, 89, 89, 149, 135],
    'NtGetCurrentProcessorNumber': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 294, 294, 366, 136],
    'NtGetDevicePowerState': [-1, -1, -1, -1, 74, 74, 74, 74, 74, 86, 86, 86, 86, 90, 90, 150, 137],
    'NtGetMUILicenseInfo': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 390, -1],
    'NtGetMUIRegistryInfo': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 394, 138],
    'NtGetNextProcess': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 368, 139],
    'NtGetNextThread': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 369, 140],
    'NtGetNlsSectionPtr': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 151, 141],
    'NtGetNotificationResourceManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 107, 142],
    'NtGetPlugPlayEvent': [61, 61, 61, 61, 75, 75, 75, 75, 75, 87, 87, 87, 87, 91, 91, 152, 143],
    'NtGetTickCount': [62, 62, 62, 62, 76, 76, 76, 76, 76, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtGetWriteWatch': [-1, -1, -1, -1, 77, 77, 77, 77, 77, 88, 88, 88, 88, 92, 92, 153, 144],
    'NtImpersonateAnonymousToken': [-1, -1, -1, -1, 78, 78, 78, 78, 78, 89, 89, 89, 89, 93, 93, 154, 145],
    'NtImpersonateClientOfPort': [63, 63, 63, 63, 79, 79, 79, 79, 79, 90, 90, 90, 90, 94, 94, 155, 146],
    'NtImpersonateThread': [64, 64, 64, 64, 80, 80, 80, 80, 80, 91, 91, 91, 91, 95, 95, 156, 147],
    'NtInitializeNlsFiles': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 157, 148],
    'NtInitializeRegistry': [65, 65, 65, 65, 81, 81, 81, 81, 81, 92, 92, 92, 92, 96, 96, 158, 149],
    'NtInitiatePowerAction': [-1, -1, -1, -1, 82, 82, 82, 82, 82, 93, 93, 93, 93, 97, 97, 159, 150],
    'NtIsProcessInJob': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 94, 94, 94, 94, 98, 98, 160, 151],
    'NtIsSystemResumeAutomatic': [-1, -1, -1, -1, 83, 83, 83, 83, 83, 95, 95, 95, 95, 99, 99, 161, 152],
    'NtIsUILanguageComitted': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 392, 153],
    'NtListTransactions': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 389, -1],
    'NtListenChannel': [206, 205, 205, 205, 242, 242, 242, 242, 242, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtListenPort': [66, 66, 66, 66, 84, 84, 84, 84, 84, 96, 96, 96, 96, 100, 100, 162, 154],
    'NtLoadDriver': [67, 67, 67, 67, 85, 85, 85, 85, 85, 97, 97, 97, 97, 101, 101, 163, 155],
    'NtLoadKey': [68, 68, 68, 68, 86, 86, 86, 86, 86, 98, 98, 98, 98, 102, 102, 164, 156],
    'NtLoadKey2': [69, 69, 69, 69, 87, 87, 87, 87, 87, 99, 99, 99, 99, 103, 103, 165, 157],
    'NtLoadKeyEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 104, 104, 166, 158],
    'NtLockFile': [70, 70, 70, 70, 88, 88, 88, 88, 88, 100, 100, 100, 100, 105, 105, 167, 159],
    'NtLockProductActivationKeys': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 101, 101, 101, 101, 106, 106, 168, 160],
    'NtLockRegistryKey': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 102, 102, 102, 102, 107, 107, 169, 161],
    'NtLockVirtualMemory': [71, 71, 71, 71, 89, 89, 89, 89, 89, 103, 103, 103, 103, 108, 108, 170, 162],
    'NtMakePermanentObject': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 104, 104, 104, 104, 109, 109, 171, 163],
    'NtMakeTemporaryObject': [72, 72, 72, 72, 90, 90, 90, 90, 90, 105, 105, 105, 105, 110, 110, 172, 164],
    'NtMapCMFModule': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 388, 165],
    'NtMapUserPhysicalPages': [-1, -1, -1, -1, 91, 91, 91, 91, 91, 106, 106, 106, 106, 111, 111, 173, 166],
    'NtMapUserPhysicalPagesScatter': [-1, -1, -1, -1, 92, 92, 92, 92, 92, 107, 107, 107, 107, 112, 112, 174, 167],
    'NtMapViewOfSection': [73, 73, 73, 73, 93, 93, 93, 93, 93, 108, 108, 108, 108, 113, 113, 175, 168],
    'NtMarshallTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 375, -1],
    'NtModifyBootEntry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 109, 109, 109, 21, 114, 114, 176, 169],
    'NtModifyDriverEntry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 115, 115, 177, 170],
    'NtNotifyChangeDirectoryFile': [74, 74, 74, 74, 94, 94, 94, 94, 94, 110, 110, 110, 110, 116, 116, 178, 171],
    'NtNotifyChangeKey': [75, 75, 75, 75, 95, 95, 95, 95, 95, 111, 111, 111, 111, 117, 117, 179, 172],
    'NtNotifyChangeMultipleKeys': [-1, -1, -1, -1, 96, 96, 96, 96, 96, 112, 112, 112, 112, 118, 118, 180, 173],
    'NtNotifyChangeSession': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 174],
    'NtOpenChannel': [207, 206, 206, 206, 243, 243, 243, 243, 243, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtOpenDirectoryObject': [76, 76, 76, 76, 97, 97, 97, 97, 97, 113, 113, 113, 113, 119, 119, 181, 175],
    'NtOpenEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 110, 176],
    'NtOpenEvent': [77, 77, 77, 77, 98, 98, 98, 98, 98, 114, 114, 114, 114, 120, 120, 182, 177],
    'NtOpenEventPair': [78, 78, 78, 78, 99, 99, 99, 99, 99, 115, 115, 115, 115, 121, 121, 183, 178],
    'NtOpenFile': [79, 79, 79, 79, 100, 100, 100, 100, 100, 116, 116, 116, 116, 122, 122, 184, 179],
    'NtOpenIoCompletion': [80, 80, 80, 80, 101, 101, 101, 101, 101, 117, 117, 117, 117, 123, 123, 185, 180],
    'NtOpenJobObject': [-1, -1, -1, -1, 102, 102, 102, 102, 102, 118, 118, 118, 118, 124, 124, 186, 181],
    'NtOpenKey': [81, 81, 81, 81, 103, 103, 103, 103, 103, 119, 119, 119, 119, 125, 125, 187, 182],
    'NtOpenKeyEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 183],
    'NtOpenKeyTransacted': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 185],
    'NtOpenKeyTransactedEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 186],
    'NtOpenKeyedEvent': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 280, 280, 280, 280, 290, 290, 362, 184],
    'NtOpenMutant': [82, 82, 82, 82, 104, 104, 104, 104, 104, 120, 120, 120, 120, 126, 126, 188, 187],
    'NtOpenObjectAuditAlarm': [83, 83, 83, 83, 105, 105, 105, 105, 105, 121, 121, 121, 121, 127, 127, 190, 188],
    'NtOpenPrivateNamespace': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 189, 189],
    'NtOpenProcess': [84, 84, 84, 84, 106, 106, 106, 106, 106, 122, 122, 122, 122, 128, 128, 191, 190],
    'NtOpenProcessToken': [85, 85, 85, 85, 107, 107, 107, 107, 107, 123, 123, 123, 123, 129, 129, 192, 191],
    'NtOpenProcessTokenEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 124, 124, 124, 124, 130, 130, 193, 192],
    'NtOpenResourceManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 106, 193],
    'NtOpenSection': [86, 86, 86, 86, 108, 108, 108, 108, 108, 125, 125, 125, 125, 131, 131, 194, 194],
    'NtOpenSemaphore': [87, 87, 87, 87, 109, 109, 109, 109, 109, 126, 126, 126, 126, 132, 132, 195, 195],
    'NtOpenSession': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 196, 196],
    'NtOpenSymbolicLinkObject': [88, 88, 88, 88, 110, 110, 110, 110, 110, 127, 127, 127, 127, 133, 133, 197, 197],
    'NtOpenThread': [89, 89, 89, 89, 111, 111, 111, 111, 111, 128, 128, 128, 128, 134, 134, 198, 198],
    'NtOpenThreadToken': [90, 90, 90, 90, 112, 112, 112, 112, 112, 129, 129, 129, 129, 135, 135, 199, 199],
    'NtOpenThreadTokenEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 130, 130, 130, 130, 136, 136, 200, 200],
    'NtOpenTimer': [91, 91, 91, 91, 113, 113, 113, 113, 113, 131, 131, 131, 131, 137, 137, 201, 201],
    'NtOpenTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 80, 202],
    'NtOpenTransactionManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 99, 203],
    'NtOpenWinStation': [-1, 212, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtPlugPlayControl': [92, 92, 92, 92, 114, 114, 114, 114, 114, 132, 132, 132, 132, 138, 138, 202, 204],
    'NtPowerInformation': [-1, -1, -1, -1, 115, 115, 115, 115, 115, 133, 133, 133, 133, 139, 139, 203, 205],
    'NtPrePrepareComplete': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 91, 208],
    'NtPrePrepareEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 83, 209],
    'NtPrepareComplete': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 92, 206],
    'NtPrepareEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 84, 207],
    'NtPrivilegeCheck': [93, 93, 93, 93, 116, 116, 116, 116, 116, 134, 134, 134, 134, 140, 140, 204, 210],
    'NtPrivilegeObjectAuditAlarm': [95, 95, 95, 95, 118, 118, 118, 118, 118, 135, 135, 135, 135, 141, 141, 205, 212],
    'NtPrivilegedServiceAuditAlarm': [94, 94, 94, 94, 117, 117, 117, 117, 117, 136, 136, 136, 136, 142, 142, 206, 211],
    'NtPropagationComplete': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 376, 213],
    'NtPropagationFailed': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 377, 214],
    'NtProtectVirtualMemory': [96, 96, 96, 96, 119, 119, 119, 119, 119, 137, 137, 137, 137, 143, 143, 207, 215],
    'NtPullTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 374, -1],
    'NtPulseEvent': [97, 97, 97, 97, 120, 120, 120, 120, 120, 138, 138, 138, 138, 144, 144, 208, 216],
    'NtQueryAttributesFile': [99, 99, 99, 99, 122, 122, 122, 122, 122, 139, 139, 139, 139, 145, 145, 209, 217],
    'NtQueryBootEntryOrder': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 140, 140, 140, -1, 146, 146, 210, 218],
    'NtQueryBootOptions': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 141, 141, 141, -1, 147, 147, 211, 219],
    'NtQueryDebugFilterState': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 142, 142, 142, 142, 148, 148, 212, 220],
    'NtQueryDefaultLocale': [100, 100, 100, 100, 123, 123, 123, 123, 123, 143, 143, 143, 143, 149, 149, 213, 221],
    'NtQueryDefaultUILanguage': [-1, -1, -1, -1, 124, 124, 124, 124, 124, 144, 144, 144, 144, 150, 150, 214, 222],
    'NtQueryDirectoryFile': [101, 101, 101, 101, 125, 125, 125, 125, 125, 145, 145, 145, 145, 151, 151, 215, 223],
    'NtQueryDirectoryObject': [102, 102, 102, 102, 126, 126, 126, 126, 126, 146, 146, 146, 146, 152, 152, 216, 224],
    'NtQueryDriverEntryOrder': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 153, 153, 217, 225],
    'NtQueryEaFile': [103, 103, 103, 103, 127, 127, 127, 127, 127, 147, 147, 147, 147, 154, 154, 218, 226],
    'NtQueryEvent': [104, 104, 104, 104, 128, 128, 128, 128, 128, 148, 148, 148, 148, 155, 155, 219, 227],
    'NtQueryFullAttributesFile': [105, 105, 105, 105, 129, 129, 129, 129, 129, 149, 149, 149, 149, 156, 156, 220, 228],
    'NtQueryInformationAtom': [98, 98, 98, 98, 121, 121, 121, 121, 121, 150, 150, 150, 150, 157, 157, 221, 229],
    'NtQueryInformationEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 112, 230],
    'NtQueryInformationFile': [106, 106, 106, 106, 130, 130, 130, 130, 130, 151, 151, 151, 151, 158, 158, 222, 231],
    'NtQueryInformationJobObject': [-1, -1, -1, -1, 131, 131, 131, 131, 131, 152, 152, 152, 152, 159, 159, 223, 232],
    'NtQueryInformationPort': [108, 108, 108, 108, 133, 133, 133, 133, 133, 153, 153, 153, 153, 160, 160, 224, 233],
    'NtQueryInformationProcess': [109, 109, 109, 109, 134, 134, 134, 134, 134, 154, 154, 154, 154, 161, 161, 225, 234],
    'NtQueryInformationResourceManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 108, 235],
    'NtQueryInformationThread': [110, 110, 110, 110, 135, 135, 135, 135, 135, 155, 155, 155, 155, 162, 162, 226, 236],
    'NtQueryInformationToken': [111, 111, 111, 111, 136, 136, 136, 136, 136, 156, 156, 156, 156, 163, 163, 227, 237],
    'NtQueryInformationTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 81, 238],
    'NtQueryInformationTransactionManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 82, 239],
    'NtQueryInformationWorkerFactory': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 382, 240],
    'NtQueryInstallUILanguage': [-1, -1, -1, -1, 137, 137, 137, 137, 137, 157, 157, 157, 157, 164, 164, 228, 241],
    'NtQueryIntervalProfile': [112, 112, 112, 112, 138, 138, 138, 138, 138, 158, 158, 158, 158, 165, 165, 229, 242],
    'NtQueryIoCompletion': [107, 107, 107, 107, 132, 132, 132, 132, 132, 159, 159, 159, 159, 166, 166, 230, 243],
    'NtQueryKey': [113, 113, 113, 113, 139, 139, 139, 139, 139, 160, 160, 160, 160, 167, 167, 231, 244],
    'NtQueryLicenseValue': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 387, 245],
    'NtQueryMultipleValueKey': [114, 114, 114, 114, 140, 140, 140, 140, 140, 161, 161, 161, 161, 168, 168, 232, 246],
    'NtQueryMutant': [115, 115, 115, 115, 141, 141, 141, 141, 141, 162, 162, 162, 162, 169, 169, 233, 247],
    'NtQueryObject': [116, 116, 116, 116, 142, 142, 142, 142, 142, 163, 163, 163, 163, 170, 170, 234, 248],
    'NtQueryOleDirectoryFile': [117, 117, 117, 117, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtQueryOpenSubKeys': [-1, -1, -1, -1, 143, 143, 143, 143, 143, 164, 164, 164, 164, 171, 171, 235, 249],
    'NtQueryOpenSubKeysEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 172, 172, 236, 250],
    'NtQueryPerformanceCounter': [118, 118, 118, 118, 144, 144, 144, 144, 144, 165, 165, 165, 165, 173, 173, 237, 251],
    'NtQueryPortInformationProcess': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 283, 283, 283, 283, 293, 293, 365, 252],
    'NtQueryQuotaInformationFile': [-1, -1, -1, -1, 145, 145, 145, 145, 145, 166, 166, 166, 166, 174, 174, 238, 253],
    'NtQuerySection': [119, 119, 119, 119, 146, 146, 146, 146, 146, 167, 167, 167, 167, 175, 175, 239, 254],
    'NtQuerySecurityAttributesToken': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 255],
    'NtQuerySecurityObject': [120, 120, 120, 120, 147, 147, 147, 147, 147, 168, 168, 168, 168, 176, 176, 240, 256],
    'NtQuerySemaphore': [121, 121, 121, 121, 148, 148, 148, 148, 148, 169, 169, 169, 169, 177, 177, 241, 257],
    'NtQuerySymbolicLinkObject': [122, 122, 122, 122, 149, 149, 149, 149, 149, 170, 170, 170, 170, 178, 178, 242, 258],
    'NtQuerySystemEnvironmentValue': [123, 123, 123, 123, 150, 150, 150, 150, 150, 171, 171, 171, 171, 179, 179, 243, 259],
    'NtQuerySystemEnvironmentValueEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 172, 172, 172, 172, 180, 180, 244, 260],
    'NtQuerySystemInformation': [124, 124, 124, 124, 151, 151, 151, 151, 151, 173, 173, 173, 173, 181, 181, 245, 261],
    'NtQuerySystemInformationEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 262],
    'NtQuerySystemTime': [125, 125, 125, 125, 152, 152, 152, 152, 152, 174, 174, 174, 174, 182, 182, 246, 263],
    'NtQueryTimer': [126, 126, 126, 126, 153, 153, 153, 153, 153, 175, 175, 175, 175, 183, 183, 247, 264],
    'NtQueryTimerResolution': [127, 127, 127, 127, 154, 154, 154, 154, 154, 176, 176, 176, 176, 184, 184, 248, 265],
    'NtQueryValueKey': [128, 128, 128, 128, 155, 155, 155, 155, 155, 177, 177, 177, 177, 185, 185, 249, 266],
    'NtQueryVirtualMemory': [129, 129, 129, 129, 156, 156, 156, 156, 156, 178, 178, 178, 178, 186, 186, 250, 267],
    'NtQueryVolumeInformationFile': [130, 130, 130, 130, 157, 157, 157, 157, 157, 179, 179, 179, 179, 187, 187, 251, 268],
    'NtQueryWinStationInformation': [-1, 213, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtQueueApcThread': [131, 131, 131, 131, 158, 158, 158, 158, 158, 180, 180, 180, 180, 188, 188, 252, 269],
    'NtQueueApcThreadEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 270],
    'NtRaiseException': [132, 132, 132, 132, 159, 159, 159, 159, 159, 181, 181, 181, 181, 189, 189, 253, 271],
    'NtRaiseHardError': [133, 133, 133, 133, 160, 160, 160, 160, 160, 182, 182, 182, 182, 190, 190, 254, 272],
    'NtReadFile': [134, 134, 134, 134, 161, 161, 161, 161, 161, 183, 183, 183, 183, 191, 191, 255, 273],
    'NtReadFileScatter': [135, 135, 135, 135, 162, 162, 162, 162, 162, 184, 184, 184, 184, 192, 192, 256, 274],
    'NtReadOnlyEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 86, 275],
    'NtReadRequestData': [136, 136, 136, 136, 163, 163, 163, 163, 163, 185, 185, 185, 185, 193, 193, 257, 276],
    'NtReadVirtualMemory': [137, 137, 137, 137, 164, 164, 164, 164, 164, 186, 186, 186, 186, 194, 194, 258, 277],
    'NtRecoverEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 102, 278],
    'NtRecoverResourceManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 103, 279],
    'NtRecoverTransactionManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 104, 280],
    'NtRegisterProtocolAddressInformation': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 373, 281],
    'NtRegisterThreadTerminatePort': [138, 138, 138, 138, 165, 165, 165, 165, 165, 187, 187, 187, 187, 195, 195, 259, 282],
    'NtReleaseKeyedEvent': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 281, 281, 281, 281, 291, 291, 363, 283],
    'NtReleaseMutant': [139, 139, 139, 139, 166, 166, 166, 166, 166, 188, 188, 188, 188, 196, 196, 260, 284],
    'NtReleaseSemaphore': [140, 140, 140, 140, 167, 167, 167, 167, 167, 189, 189, 189, 189, 197, 197, 261, 285],
    'NtReleaseWorkerFactoryWorker': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 379, 286],
    'NtRemoveIoCompletion': [141, 141, 141, 141, 168, 168, 168, 168, 168, 190, 190, 190, 190, 198, 198, 262, 287],
    'NtRemoveIoCompletionEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 372, 288],
    'NtRemoveProcessDebug': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 191, 191, 191, 191, 199, 199, 263, 289],
    'NtRenameKey': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 192, 192, 192, 192, 200, 200, 264, 290],
    'NtRenameTransactionManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 100, 291],
    'NtReplaceKey': [142, 142, 142, 142, 169, 169, 169, 169, 169, 193, 193, 193, 193, 201, 201, 265, 292],
    'NtReplacePartitionUnit': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 293],
    'NtReplyPort': [143, 143, 143, 143, 170, 170, 170, 170, 170, 194, 194, 194, 194, 202, 202, 266, 294],
    'NtReplyWaitReceivePort': [144, 144, 144, 144, 171, 171, 171, 171, 171, 195, 195, 195, 195, 203, 203, 267, 295],
    'NtReplyWaitReceivePortEx': [-1, -1, -1, -1, 172, 172, 172, 172, 172, 196, 196, 196, 196, 204, 204, 268, 296],
    'NtReplyWaitReplyPort': [145, 145, 145, 145, 173, 173, 173, 173, 173, 197, 197, 197, 197, 205, 205, 269, 297],
    'NtReplyWaitSendChannel': [208, 207, 207, 207, 244, 244, 244, 244, 244, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtRequestDeviceWakeup': [-1, -1, -1, -1, 174, 174, 174, 174, 174, 198, 198, 198, 198, 206, 206, 270, -1],
    'NtRequestPort': [146, 146, 146, 146, 175, 175, 175, 175, 175, 199, 199, 199, 199, 207, 207, 271, 298],
    'NtRequestWaitReplyPort': [147, 147, 147, 147, 176, 176, 176, 176, 176, 200, 200, 200, 200, 208, 208, 272, 299],
    'NtRequestWakeupLatency': [-1, -1, -1, -1, 177, 177, 177, 177, 177, 201, 201, 201, 201, 209, 209, 273, -1],
    'NtResetEvent': [148, 148, 148, 148, 178, 178, 178, 178, 178, 202, 202, 202, 202, 210, 210, 274, 300],
    'NtResetWriteWatch': [-1, -1, -1, -1, 179, 179, 179, 179, 179, 203, 203, 203, 203, 211, 211, 275, 301],
    'NtRestoreKey': [149, 149, 149, 149, 180, 180, 180, 180, 180, 204, 204, 204, 204, 212, 212, 276, 302],
    'NtResumeProcess': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 205, 205, 205, 205, 213, 213, 277, 303],
    'NtResumeThread': [150, 150, 150, 150, 181, 181, 181, 181, 181, 206, 206, 206, 206, 214, 214, 278, 304],
    'NtRollbackComplete': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 87, 305],
    'NtRollbackEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 88, 306],
    'NtRollbackSavepointTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 284, -1],
    'NtRollbackTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 90, 307],
    'NtRollforwardTransactionManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 101, 308],
    'NtSaveKey': [151, 151, 151, 151, 182, 182, 182, 182, 182, 207, 207, 207, 207, 215, 215, 279, 309],
    'NtSaveKeyEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 208, 208, 208, 208, 216, 216, 280, 310],
    'NtSaveMergedKeys': [-1, -1, -1, -1, 183, 183, 183, 183, 183, 209, 209, 209, 209, 217, 217, 281, 311],
    'NtSavepointComplete': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 286, -1],
    'NtSavepointTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 285, -1],
    'NtSecureConnectPort': [-1, -1, -1, -1, 184, 184, 184, 184, 184, 210, 210, 210, 210, 218, 218, 287, 312],
    'NtSendWaitReplyChannel': [209, 208, 208, 208, 245, 245, 245, 245, 245, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtSerializeBoot': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 313],
    'NtSetBootEntryOrder': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 211, 211, 211, -1, 219, 219, 288, 314],
    'NtSetBootOptions': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 212, 212, 212, -1, 220, 220, 289, 315],
    'NtSetContextChannel': [210, 209, 209, 209, 246, 246, 246, 246, 246, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtSetContextThread': [153, 153, 153, 153, 186, 186, 186, 186, 186, 213, 213, 213, 213, 221, 221, 290, 316],
    'NtSetDebugFilterState': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 214, 214, 214, 214, 222, 222, 291, 317],
    'NtSetDefaultHardErrorPort': [154, 154, 154, 154, 187, 187, 187, 187, 187, 215, 215, 215, 215, 223, 223, 292, 318],
    'NtSetDefaultLocale': [155, 155, 155, 155, 188, 188, 188, 188, 188, 216, 216, 216, 216, 224, 224, 293, 319],
    'NtSetDefaultUILanguage': [-1, -1, -1, -1, 189, 189, 189, 189, 189, 217, 217, 217, 217, 225, 225, 294, 320],
    'NtSetDriverEntryOrder': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 226, 226, 295, 321],
    'NtSetEaFile': [156, 156, 156, 156, 190, 190, 190, 190, 190, 218, 218, 218, 218, 227, 227, 296, 322],
    'NtSetEvent': [157, 157, 157, 157, 191, 191, 191, 191, 191, 219, 219, 219, 219, 228, 228, 297, 323],
    'NtSetEventBoostPriority': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 220, 220, 220, 220, 229, 229, 298, 324],
    'NtSetHighEventPair': [158, 158, 158, 158, 192, 192, 192, 192, 192, 221, 221, 221, 221, 230, 230, 299, 325],
    'NtSetHighWaitLowEventPair': [159, 159, 159, 159, 193, 193, 193, 193, 193, 222, 222, 222, 222, 231, 231, 300, 326],
    'NtSetHighWaitLowThread': [160, 160, 160, 160, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtSetInformationDebugObject': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 223, 223, 223, 223, 232, 232, 301, 327],
    'NtSetInformationEnlistment': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 111, 328],
    'NtSetInformationFile': [161, 161, 161, 161, 194, 194, 194, 194, 194, 224, 224, 224, 224, 233, 233, 302, 329],
    'NtSetInformationJobObject': [-1, -1, -1, -1, 195, 195, 195, 195, 195, 225, 225, 225, 225, 234, 234, 303, 330],
    'NtSetInformationKey': [162, 162, 162, 162, 196, 196, 196, 196, 196, 226, 226, 226, 226, 235, 235, 304, 331],
    'NtSetInformationObject': [163, 163, 163, 163, 197, 197, 197, 197, 197, 227, 227, 227, 227, 236, 236, 305, 332],
    'NtSetInformationProcess': [164, 164, 164, 164, 198, 198, 198, 198, 198, 228, 228, 228, 228, 237, 237, 306, 333],
    'NtSetInformationResourceManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 97, 334],
    'NtSetInformationThread': [165, 165, 165, 165, 199, 199, 199, 199, 199, 229, 229, 229, 229, 238, 238, 307, 335],
    'NtSetInformationToken': [166, 166, 166, 166, 200, 200, 200, 200, 200, 230, 230, 230, 230, 239, 239, 308, 336],
    'NtSetInformationTransaction': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 95, 337],
    'NtSetInformationTransactionManager': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 96, 338],
    'NtSetInformationWorkerFactory': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 381, 339],
    'NtSetIntervalProfile': [167, 167, 167, 167, 201, 201, 201, 201, 201, 231, 231, 231, 231, 240, 240, 309, 340],
    'NtSetIoCompletion': [152, 152, 152, 152, 185, 185, 185, 185, 185, 232, 232, 232, 232, 241, 241, 310, 341],
    'NtSetIoCompletionEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 342],
    'NtSetLdtEntries': [168, 168, 168, 168, 202, 202, 202, 202, 202, 233, 233, 233, 233, 242, 242, 311, 343],
    'NtSetLowEventPair': [169, 169, 169, 169, 203, 203, 203, 203, 203, 234, 234, 234, 234, 243, 243, 312, 344],
    'NtSetLowWaitHighEventPair': [170, 170, 170, 170, 204, 204, 204, 204, 204, 235, 235, 235, 235, 244, 244, 313, 345],
    'NtSetLowWaitHighThread': [171, 171, 171, 171, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtSetQuotaInformationFile': [-1, -1, -1, -1, 205, 205, 205, 205, 205, 236, 236, 236, 236, 245, 245, 314, 346],
    'NtSetSecurityObject': [172, 172, 172, 172, 206, 206, 206, 206, 206, 237, 237, 237, 237, 246, 246, 315, 347],
    'NtSetSystemEnvironmentValue': [173, 173, 173, 173, 207, 207, 207, 207, 207, 238, 238, 238, 238, 247, 247, 316, 348],
    'NtSetSystemEnvironmentValueEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 239, 239, 239, -1, 248, 248, 317, 349],
    'NtSetSystemInformation': [174, 174, 174, 174, 208, 208, 208, 208, 208, 240, 240, 240, 240, 249, 249, 318, 350],
    'NtSetSystemPowerState': [175, 175, 175, 175, 209, 209, 209, 209, 209, 241, 241, 241, 241, 250, 250, 319, 351],
    'NtSetSystemTime': [176, 176, 176, 176, 210, 210, 210, 210, 210, 242, 242, 242, 242, 251, 251, 320, 352],
    'NtSetThreadExecutionState': [-1, -1, -1, -1, 211, 211, 211, 211, 211, 243, 243, 243, 243, 252, 252, 321, 353],
    'NtSetTimer': [177, 177, 177, 177, 212, 212, 212, 212, 212, 244, 244, 244, 244, 253, 253, 322, 354],
    'NtSetTimerEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 355],
    'NtSetTimerResolution': [178, 178, 178, 178, 213, 213, 213, 213, 213, 245, 245, 245, 245, 254, 254, 323, 356],
    'NtSetUuidSeed': [-1, -1, -1, -1, 214, 214, 214, 214, 214, 246, 246, 246, 246, 255, 255, 324, 357],
    'NtSetValueKey': [179, 179, 179, 179, 215, 215, 215, 215, 215, 247, 247, 247, 247, 256, 256, 325, 358],
    'NtSetVolumeInformationFile': [180, 180, 180, 180, 216, 216, 216, 216, 216, 248, 248, 248, 248, 257, 257, 326, 359],
    'NtSetWinStationInformation': [-1, 214, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtShutdownSystem': [181, 181, 181, 181, 217, 217, 217, 217, 217, 249, 249, 249, 249, 258, 258, 327, 360],
    'NtShutdownWorkerFactory': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 384, 361],
    'NtSignalAndWaitForSingleObject': [182, 182, 182, 182, 218, 218, 218, 218, 218, 250, 250, 250, 250, 259, 259, 328, 362],
    'NtSinglePhaseReject': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 94, 363],
    'NtStartProfile': [183, 183, 183, 183, 219, 219, 219, 219, 219, 251, 251, 251, 251, 260, 260, 329, 364],
    'NtStartTm': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 113, -1],
    'NtStopProfile': [184, 184, 184, 184, 220, 220, 220, 220, 220, 252, 252, 252, 252, 261, 261, 330, 365],
    'NtSuspendProcess': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 253, 253, 253, 253, 262, 262, 331, 366],
    'NtSuspendThread': [185, 185, 185, 185, 221, 221, 221, 221, 221, 254, 254, 254, 254, 263, 263, 332, 367],
    'NtSystemDebugControl': [186, 186, 186, 186, 222, 222, 222, 222, 222, 255, 255, 255, 255, 264, 264, 333, 368],
    'NtTerminateJobObject': [-1, -1, -1, -1, 223, 223, 223, 223, 223, 256, 256, 256, 256, 265, 265, 334, 369],
    'NtTerminateProcess': [187, 187, 187, 187, 224, 224, 224, 224, 224, 257, 257, 257, 257, 266, 266, 335, 370],
    'NtTerminateThread': [188, 188, 188, 188, 225, 225, 225, 225, 225, 258, 258, 258, 258, 267, 267, 336, 371],
    'NtTestAlert': [189, 189, 189, 189, 226, 226, 226, 226, 226, 259, 259, 259, 259, 268, 268, 337, 372],
    'NtThawRegistry': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 338, 373],
    'NtThawTransactions': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 339, 374],
    'NtTraceControl': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 341, 375],
    'NtTraceEvent': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 260, 260, 260, 260, 269, 269, 340, 376],
    'NtTranslateFilePath': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 261, 261, 261, 261, 270, 270, 342, 377],
    'NtUmsThreadYield': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 378],
    'NtUnloadDriver': [190, 190, 190, 190, 227, 227, 227, 227, 227, 262, 262, 262, 262, 271, 271, 343, 379],
    'NtUnloadKey': [191, 191, 191, 191, 228, 228, 228, 228, 228, 263, 263, 263, 263, 272, 272, 344, 380],
    'NtUnloadKey2': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 273, 273, 345, 381],
    'NtUnloadKeyEx': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 264, 264, 264, 264, 274, 274, 346, 382],
    'NtUnlockFile': [192, 192, 192, 192, 229, 229, 229, 229, 229, 265, 265, 265, 265, 275, 275, 347, 383],
    'NtUnlockVirtualMemory': [193, 193, 193, 193, 230, 230, 230, 230, 230, 266, 266, 266, 266, 276, 276, 348, 384],
    'NtUnmapViewOfSection': [194, 194, 194, 194, 231, 231, 231, 231, 231, 267, 267, 267, 267, 277, 277, 349, 385],
    'NtVdmControl': [195, 195, 195, 195, 232, 232, 232, 232, 232, 268, 268, 268, 268, 278, 278, 350, 386],
    'NtW32Call': [204, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtWaitForDebugEvent': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 269, 269, 269, 269, 279, 279, 351, 387],
    'NtWaitForKeyedEvent': [-1, -1, -1, -1, -1, -1, -1, -1, -1, 282, 282, 282, 282, 292, 292, 364, 388],
    'NtWaitForMultipleObjects': [196, 196, 196, 196, 233, 233, 233, 233, 233, 270, 270, 270, 270, 280, 280, 352, 389],
    'NtWaitForMultipleObjects32': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 295, 367, 390],
    'NtWaitForSingleObject': [197, 197, 197, 197, 234, 234, 234, 234, 234, 271, 271, 271, 271, 281, 281, 353, 391],
    'NtWaitForWorkViaWorkerFactory': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 380, 392],
    'NtWaitHighEventPair': [198, 198, 198, 198, 235, 235, 235, 235, 235, 272, 272, 272, 272, 282, 282, 354, 393],
    'NtWaitLowEventPair': [199, 199, 199, 199, 236, 236, 236, 236, 236, 273, 273, 273, 273, 283, 283, 355, 394],
    'NtWorkerFactoryWorkerReady': [-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 383, 395],
    'NtWriteErrorLogEntry': [-1, 215, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1],
    'NtWriteFile': [200, 200, 200, 200, 237, 237, 237, 237, 237, 274, 274, 274, 274, 284, 284, 356, 396],
    'NtWriteFileGather': [201, 201, 201, 201, 238, 238, 238, 238, 238, 275, 275, 275, 275, 285, 285, 357, 397],
    'NtWriteRequestData': [202, 202, 202, 202, 239, 239, 239, 239, 239, 276, 276, 276, 276, 286, 286, 358, 398],
    'NtWriteVirtualMemory': [203, 203, 203, 203, 240, 240, 240, 240, 240, 277, 277, 277, 277, 287, 287, 359, 399],
    'NtYieldExecution': [211, 210, 210, 210, 247, 247, 247, 247, 247, 278, 278, 278, 278, 288, 288, 360, 400],
}
# generated by pnf, added xp-sp3 and seven-sp0 to the tables from the ms project
